General

  • Target

    JaffaCakes118_f971ede08d872f59e5cfb82952c519b5195e6775e0b6a0dd1b39fbccb4eaf729

  • Size

    737.5MB

  • Sample

    241227-ax7t3awpby

  • MD5

    9a9cc863eeafa633573aaa699b514459

  • SHA1

    e7adbc3e16cbc3b52bd3a7c188366ad1990866a9

  • SHA256

    f971ede08d872f59e5cfb82952c519b5195e6775e0b6a0dd1b39fbccb4eaf729

  • SHA512

    ad2d65d27f26c552b8db88818f1352592f49742016b1b30ee18791f9e8a9a43d52ee92813a381b9546a19d774bc4aea210ec11c990adf2b8f148e1faac0b81d7

  • SSDEEP

    12288:xB4tq6zxNzhzrzT9L1sre79Llnto47Svi:xBObtNBT4ibL7c

Malware Config

Extracted

Family

redline

Botnet

639820823_99

C2

popshues.top:28786

Attributes
  • auth_value

    530397d6b703221b919d6118285563cd

Targets

    • Target

      JaffaCakes118_f971ede08d872f59e5cfb82952c519b5195e6775e0b6a0dd1b39fbccb4eaf729

    • Size

      737.5MB

    • MD5

      9a9cc863eeafa633573aaa699b514459

    • SHA1

      e7adbc3e16cbc3b52bd3a7c188366ad1990866a9

    • SHA256

      f971ede08d872f59e5cfb82952c519b5195e6775e0b6a0dd1b39fbccb4eaf729

    • SHA512

      ad2d65d27f26c552b8db88818f1352592f49742016b1b30ee18791f9e8a9a43d52ee92813a381b9546a19d774bc4aea210ec11c990adf2b8f148e1faac0b81d7

    • SSDEEP

      12288:xB4tq6zxNzhzrzT9L1sre79Llnto47Svi:xBObtNBT4ibL7c

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks